Client/server computing has become quite a popular architecture in both system and large organizations. As known, these systems include a computer system which operates as a server for a plurality of personal computers and/or workstations, which are generally connected to the server via a network connection comprising a local area network (LAN) or a wide area network (WAN).
Client/server computing networks have dramatically increased and facilitated access to information. However, due to the ubiquitous nature of computer networks the threat to the integrity of information stored on network resources due to "hackers"/"attackers" and malicious software components (e.g., operating system and application program viruses) has also increased. Threats include any person, place or thing which poses some danger to a network asset. Passswords and other similar operating system level security features often only make it difficult for the hacker/attacker to gain access to the network. However, a patient and capable hacker/attacker can generally bypass most conventional operating system level protections.
Intrusion detection programs (i.e., virus checking programs) are commonly used in order to detect unauthorized modifications to executable programs. However, a particular problem with these intrusion detection programs is that they operate only after the operating system has been started. Therefore, the intrusion detection program is untrusted, and can be altered by a hacker since it operates after the operating system has initiated operation. For example, the intrusion detection software may be attacked by a "Trojan horse", which is generally defined as a piece of code embedded in a useful program for nefarious purposes, such as to covertly steal information, and which can arrange to have itself restarted on every system reboot. Therefore, the integrity of a intrusion detection program which operates following system boot is suspect due to its vulnerability to attack, by for example, a Trojan horse. In addition, prior art workstation intrusion detection programs are cumbersome on the user, since they often require the user to use a floppy drive and manually download virus signature files to the workstation.
Therefore, there is a need for a more secure, user friendly technique for detecting illicit changes to executable programs.